Read the docs
TI-2026-81047 Aliases CVE-2026-117494GHSA-mjhm-mj37-2hg8

Cross-site scripting in Sisense Cloud BI Platform via SVG images

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Sisense Cloud BI Platform from 0 before 27/10/2026 is affected. The platform does not neutralize SVG images submitted to the /api/v2/ai/sessions API, a weakness classified as CWE-79 (cross-site scripting). A remote attacker with low privileges can embed script tags in an SVG that run when the content is rendered in the assistant window, which requires active user interaction, and can alter the displayed content.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00284 21st percentileScored 2026-11-05
Fix Fixed Cloud BI Platform (Sisense): 27/10/2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SisenseCloud BI Platformbefore 27/10/202627/10/2026Patch availableCNA
  • Cloud BI Platform VendorSisense Affected before 27/10/2026 Fixed in 27/10/2026 Patch available CNA

Remediation

Upgrade Sisense Cloud BI Platform to version 27/10/2026, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Cloud BI Platform (Sisense) Fixed in 27/10/2026

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-117494
  2. 2026-10-27 Alias added: GHSA-mjhm-mj37-2hg8
  3. 2026-10-27 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed

References

Other 1

  • TI-2026-81046 Stored cross-site scripting in Sisense BloX widgets CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences